Vodder Privacy Notice

Effective October 19, 2026. Version 2026-10-19.

Vodder is an independently operated service based in Wisconsin, United States. Contact support@vodder.watch for privacy questions, account assistance, reports, or requests concerning your information. Vodder is for adults aged 18 or older. We record the version of the terms you accept and when you accept them; we do not collect your birth date or identity documents for this acknowledgment. If you believe someone under 18 is using Vodder, contact support for review and account assistance.

Information Vodder uses

Account information. Discord sign-in provides your Discord user ID, username/display name and avatar information. Vodder records a local account ID, account creation/last-login times, account tier and early-adopter status. Vodder does not receive your Discord password. OAuth credentials used to complete sign-in are not part of your account export.

Optional email. If you add an address, Vodder records it, verification status and your separate access-request/reply notification preferences. During verification it also records a pending address, hashed challenge, expiry and attempt/send counters. The six-digit code may temporarily exist in a pending delivery message. Your profile email is not displayed to other users by the application.

Content and activity. Vodder stores video references, titles and visibility settings; playlists, membership roles and share links; notes, replies, timestamps and drawings; access requests, messages and decisions; and watch/resume, time and recent-presence records. Videos play through YouTube; Vodder does not host the underlying video files.

Operation and support. The hosting environment processes requests and may retain access/error logs, including network/request information. Application rate counters use hashed identities and event counts; private diagnostics and moderation records support security, reliability and report handling. Support messages and deletion/recovery receipts are handled privately. The application does not currently include a separate advertising or marketing-analytics integration.

Purposes and visibility

Information supports sign-in, content organization, note discussions/drawings, sharing permissions, playback/resume, requested email notifications, abuse controls, troubleshooting and recovery.

Notes and drawings are visible to people allowed to view their Vodder video. Video owners can see detailed viewing statistics. Other eligible viewers can see recent presence, including display name/avatar information. A public Vodder watch page still requires sign-in; a shared playlist page can be viewed without sign-in and can reveal its name, creator attribution and public video entries. Private-video metadata is filtered for people without approval. Possession of a random video URL does not grant access to a private video.

Sharing a playlist may permit other people to join it and, if granted, edit it. Revoking a share link stops new use of that link but does not automatically remove existing members. Owners can manage membership separately. Vodder's visibility settings do not change the source video's YouTube permissions or prevent another person from retaining information they have already received.

Providers and browser storage

The service uses Namecheap hosting and mail delivery. Discord handles sign-in and avatar requests under Discord's privacy policy. YouTube/Google handles embedded playback, thumbnails and associated browser requests under Google's privacy policy. Those providers can process network/browser information and use their own cookies; Google describes its cookies here. Vodder does not control those providers' independent practices. Support mail is forwarded to the operator's Google-hosted mailbox; the private mailbox address is not published.

Vodder uses a secure, HTTP-only sign-in cookie. Normal sign-ins can last through browser restarts, expire after 30 days of inactivity and require a new sign-in at 90 days. Logout ends that session. A dedicated operator test account uses one-hour sessions. Browser storage retains note-filter preferences and drawing-toolbar position; temporary profile status messages use session storage. Clearing browser storage removes those browser preferences and can sign you out, depending on what is cleared.

Email choices

Adding an email is optional. A verified address is needed for user notifications. Requests and replies have separate switches on Profile. First verification enables both; changing an already verified address preserves the choices. Disabling a category cancels its still-pending jobs; it cannot retract a message already sent. Removing your address disables user notifications and removes verification data from the account. Operator/security alerts are a separate service function.

Reply emails identify that a reply exists and link to the Vodder video at the original note's timestamp. They do not grant video access. Self-replies and notes without a proven account author do not produce reply emails. Notification messages are automated; replies to alerts@vodder.watch are not monitored. Use the support address for help.

Access, export and deletion

Profile provides a JSON export of your own stored account information, owned video/playlist records, account-linked notes/drawings, membership records, your access requests and watch history. It excludes authentication/session secrets, verification codes/hashes, share credentials and other people's private account information. Large or unusual requests can be handled through support.

Account deletion requires a recent sign-in and an explicit typed confirmation. It removes the account, optional email/settings, owned videos/playlists, memberships, requests and watch history. Removing owned videos removes their discussions, including other people's contributions on those videos. Your account-linked note text/drawings on surviving videos are removed; anonymous deleted-user placeholders remain only where needed to preserve other people's reply structure. Other owners' independent saved copies remain. References to your deleted videos are removed from their playlists. Deletion does not delete your Discord account or the source YouTube videos. Signing in again creates a new account with default Free allowances.

Historical notes without account-ID attribution cannot safely be identified from a display-name match. Contact support to request review of specific older content. Suspended users can also contact support about access/privacy requests.

Retention and recovery

Live account/content records remain until removed or no longer needed for their service purpose. Completed/cancelled delivery jobs have sensitive delivery payloads cleared; terminal queue metadata older than seven days is removed in scheduled batches, so cleanup may take longer during a backlog or outage. Verification challenges are valid for ten minutes; expired pending verification fields can remain until a later verification/change/removal. Session access expires under the limits above; inactive private session files are subject to cleanup. Temporary account-export files are removed after delivery; stale files are cleaned on subsequent exports. PHP diagnostic logs rotate by size, rather than at a fixed age. Hosting access/error logs and provider records follow their separate operational lifecycles; contact support with questions about a specific record.

Encrypted recovery backups use a rolling selection of 14 daily, 8 weekly and 6 monthly points. Manual deployment/recovery archives also exist. Deleting live data does not rewrite existing archives or remove messages/exports already delivered. Recovery must preserve/reapply the latest deletion ledger before reopening a restored site. Restricted deletion receipts retain a local account ID and keyed identity hash, not the account's email, Discord ID or note content. Moderation audit records retain action IDs, targets, operator reasons and outcomes for investigation and recovery.

Superseded manual deployment/recovery archives are scheduled for removal after 30 days, once a usable retained recovery point and rollback needs are checked. An archive needed for safe recovery is retained until it can be replaced safely. Support correspondence is reviewed for deletion 12 months after the issue is closed. An active dispute, security investigation or legal obligation can require longer retention; the reason and next review are recorded privately. These schedules cover operator-controlled server/local copies and support mail, and do not promise deletion of copies independently retained by a provider or recipient.

Minimal deletion receipts and their matching recovery key remain while any recoverable archive could restore deleted information. Moderation records remain while needed for active enforcement, investigation and recovery. Their necessity is reviewed at least annually; records no longer needed are removed after the review, preserving active enforcement and safe recovery. These records are not automatically discarded merely because a year has passed.

Contact support to request access, correction or deletion, or raise a concern. The operator will review requests and verify account ownership as appropriate. Providers may process information in the United States and other countries under their own policies. We will identify material changes to this notice by updating its date and providing an appropriate service notice.